PT-2026-22086 · Drupal+2 · Captcha+1

Adam Nagy + 16 · Publicado 2026-02-25 · Atualizado 2026-03-30 · CVE-2026-3214

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Drupal CAPTCHA versions 0.0.0 through 1.16.9 Drupal CAPTCHA versions 2.0.0 through 2.0.9

Description A functionality bypass exists in Drupal CAPTCHA due to insufficient invalidation of security tokens. An attacker may bypass the CAPTCHA on subsequent submissions if they first successfully solve at least one CAPTCHA manually to obtain valid tokens.

Recommendations Update Drupal CAPTCHA to version 1.17.0 or later. Update Drupal CAPTCHA to version 2.0.10 or later.

Correção

Authentication Bypass Using an Alternate Path or Channel

Enumeração de Fraquezas

CWE-288

Identificadores relacionados

CVE-2026-3214

DRUPAL-CONTRIB-2026-015

Produtos afetados

Captcha

Drupal/Captcha

Referências · 5

• https://drupal.org/sa-contrib-2026-015 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3214 · Nota de Segurança
• https://twitter.com/CVEnew/status/2038618163739316733 · Publicação no Twitter
• https://osv.dev/vulnerability/DRUPAL-CONTRIB-2026-015 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2038620189692989448 · Publicação no Twitter